[
https://issues.apache.org/jira/browse/METRON-694?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15872630#comment-15872630
]
ASF GitHub Bot commented on METRON-694:
---------------------------------------
Github user merrimanr commented on the issue:
https://github.com/apache/incubator-metron/pull/453
I think removing the error indexing topology is fine as long as we're
careful to avoid error messages getting stuck in a loop in the case of a failed
index write. I agree that it will remove complexity and make this PR easier to
digest.
As of this JIRA all errors go to a single error index with source type and
error type as JSON fields. To answer your question: the error indexing
config. I can see the advantage of being able to configure each source
type/error type combination separately but I'm not sure it matters that much
since we expect it to be very low volume. I will think about that more this
weekend. From an implementation standpoint it's easy to modify so the design
should be driven by the queries we expect.
Same applies to invalid messages. Easy to do it either way, just need to
decide what makes the most sense from a user's perspective.
> Index Errors from Topologies
> ----------------------------
>
> Key: METRON-694
> URL: https://issues.apache.org/jira/browse/METRON-694
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
>
> Need to make sure (and review) that all the bolts write into the error queue.
> Errors should then be consumed from the error queue and indexed.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
